1

Im a newbe in radare and while I tried to patch a crackme binary, I opened it the first time in debug mode (-d), while debugging I used oo+ to reopen it with write mode, when I modify an instruction using wx, it works but when I quit it gives me two confirmation messages with yes no I press enter two times, then it get back to the original stat, and loose the modification, How could I keep changes even after quitting ???

0

I just tried opening a binary file and patching and it actually saves my patches. The steps I followed are:

[99:99:99] <myuser>:answer $ cp crackme0x00 crackme0x00_patched
[99:99:99] <myuser>:answer $ radare2 -Aw crackme0x00_patched
[0x08048360]> pdf@sym.main 
[0x08048360]> 0x08048487
[0x08048487]> wa ret
Written 1 bytes (ret) = wx c3
[0x08048487]> q
[99:99:99] <myuser>:answer $ cmp -l crackme0x00 crackme0x00_patched | gawk '{printf "%08X %02X %02X\n", $1, strtonum(0$2), strtonum(0$3)}' 
00000488 E8 C3

(I stole the compare script from here)

As you can see, in my case the binary remains patched even after quitting (C3 is the opcode for the ret instruction. Instead of reopening the file with oo+ as you did, I opened it in write mode with w and A (equivalent of aaa). I just tried myself and I couldn't patch binaries and save them (if anyone can give a more accurate explaination is welcome).

4

This is normal and expected behaviour. when you are in the debugger what you are modifying is the process memory, not the disk file.

  • Being a new be in the huge world of reverse ingeniering, I had not this idea in my mind, the next time, I'll be ready for similar cases (before asking) ^^ – krachleur Dec 23 '16 at 15:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.